The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates shell commands for clipboard operations (using xclip, wl-copy, or clip.exe) that interpolate untrusted data from GitHub issue titles and bodies. A maliciously crafted issue title containing shell metacharacters (e.g., backticks or $(...)) could lead to arbitrary command execution on the host system when the triage report is prepared. While the Darwin-specific pbcopy implementation uses a safe heredoc, other platforms are left vulnerable.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted data from GitHub issues and PRs into its analysis prompts. An attacker could craft an issue body or comment designed to mislead the analysis agent into recommending incorrect triage actions.
Ingestion points: Issue titles, bodies, and comments are fetched from GitHub via the gh CLI in SKILL.md (Phase 1 and Phase 2).
Boundary markers: The skill uses markdown headers like Body: and Comments: to separate untrusted content, which is a weak defense against adversarial prompts.
Capability inventory: The agent can modify GitHub issues (labels, comments, state) and execute shell commands for system operations.
Sanitization: The skill performs basic truncation of input data to 5000 characters, but lacks filtering for malicious instruction patterns.

issue-triage